# FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil & Gas Company — Evolved Two-Stage DLL Sideloading Delivers Deed RAT (0xFF66ABCD) and Terndoor via Mofu Loader

> Bitdefender Labs uncovered a sustained, three-wave intrusion against an Azerbaijani oil and gas company from late December 2025 through late February 2026, attributed with moderate-to-high confidence to the China-nexus FamousSparrow APT (overlapping the Earth Estries/UAT-9244 ecosystem). The operation re-exploits the same unpatched Microsoft Exchange server (ProxyNotShell-class CVE-2022-41040/CVE-2022-41082) across all three waves and introduces an evolved two-stage DLL sideloading trigger that overrides two specific exports (Init and ComMain) to gate the Deed RAT loader through the host application's natural control flow. Deed RAT itself has been refactored — magic value rotated from 0xDEED4554 to 0xFF66ABCD, plugin compression migrated from Snappy to Deflate, configuration magic changed to 0x46B78C45, and invocation IDs shifted by 0x100 — while Wave 2 attempted to install the Terndoor backdoor with a vmflt.sys kernel driver via the Mofu loader. Attackers re-entered the network three times despite remediation, performed RDP lateral movement with stolen domain administrator credentials, and used Impacket-style atexec/smbexec for SMB-based spread. The campaign marks FamousSparrow's first publicly reported expansion into the South Caucasus energy sector and aligns with Azerbaijan's elevated role in European energy security after the 2024 Russia-Ukraine gas transit expiration and 2026 Strait of Hormuz disruptions.

- **Published:** 2026-05-13T12:00:00Z
- **Last reviewed:** 2026-05-13T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0509
- **ID:** TL-2026-0509
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** GhostEmperor (China)
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2022-41040, CVE-2022-41082

## Description

Bitdefender Labs (Victor Vrabie, published May 13, 2026) tracked a multi-wave cyberespionage operation against an unnamed Azerbaijani oil and gas company that ran from approximately December 25, 2025 through late February 2026. The operation is attributed with moderate-to-high confidence to FamousSparrow, a Chinese APT first documented by ESET in 2021 and shown to substantially overlap with the Earth Estries toolset and tradecraft documented by Trend Micro and the Cisco Talos UAT-9244 cluster.

Initial Access (Wave 1, December 2025). The attackers exploited a publicly accessible, unpatched Microsoft Exchange server. Telemetry shows w3wp.exe (the IIS worker process) executing under the MSExchangePowerShellAppPool context — a signature of the ProxyNotShell exploit chain (CVE-2022-41040 SSRF + CVE-2022-41082 deserialization RCE). Web shell files key.aspx, log.aspx, errorFE_.aspx, and signout_.aspx were written to publicly accessible directories on December 25, 26, and 29, 2025. Each remediation attempt was followed by re-exploitation of the same entry point.

Evolved Two-Stage DLL Sideloading. After webshell access, the attackers staged three files into C:\TEMP\: the legitimate, signed LogMeIn Hamachi binary LMIGuardianSvc.exe (MD5 0554f3b69d39d175dd110d765c11347a), a malicious lmiguardiandll.dll that the host loads via DLL search-order hijacking, and an encrypted payload container .hamachi.lng. The innovation in this campaign is the loader DLL's use of two specific exported functions to split execution into a two-stage trigger:
  * Init — invoked first; modifies StartServiceCtrlDispatcherW's API entry point by relaxing memory protections, writing a hook, and preserving the original bytes for later restoration. Init then exits without running the payload, allowing LMIGuardianSvc.exe to continue along its normal control flow.
  * ComMain — invoked later during the legitimate startup sequence; when the host application naturally calls StartServiceCtrlDispatcherW, the hook redirects execution into the malicious loader, which restores the original API bytes and proceeds to decrypt and execute the .hamachi.lng payload.
The loader also exports CryptProtectDataNoUI and CryptUnprotectDataNoUI containing mbedTLS-derived cryptographic code, although these appear unreachable in the execution chain and serve as obfuscation/code-reuse cover. Because the payload only detonates if the host follows the exact expected call sequence, sandbox environments that execute exports out of context fail to trigger the chain.

Deed RAT (Waves 1 and 3). The .hamachi.lng container is AES-128-CBC encrypted with a 16-byte null IV; the key is the first 16 bytes of the file. Plaintext is shellcode plus the Deed RAT orchestrator, which is further decoded with RC4 using a key embedded at a hardcoded offset. Payload bodies are LZNT1-compressed via RtlDecompressBuffer. Compared to prior public reporting, this variant has been substantially refactored:
  * Module magic value rotated from 0xDEED4554 to 0xFF66ABCD; configuration magic now 0x46B78C45.
  * Plugin compression migrated from Snappy to Deflate for improved compatibility.
  * Plugin invocation IDs offset by 0x100; entry-point dispatcher values offset by 0x10 (vs. prior 0x1/0x2/0x4).
  * Plugin encryption uses a custom PRNG-based XOR with a 4-byte big-endian seed and 4-byte size field; strings use a stateful XOR algorithm (state = 3 * (state + ROL1(state, 3))) terminated by a byte equal to the current state.
  * APIs resolved at runtime using ELF hashing (VirtualAlloc/VirtualFree/VirtualProtect/RtlDecompressBuffer hashes computed) to hide imports.
Module IDs remain consistent across variants: 0x20 Orchestrator, 0x30 Startup, 0x40 Config, 0x50 Plugin, 0x60 Network, 0x70 NetSocket, 0x90 NetProxy, 0xA0 Install, 0xB0 Inject. Persistence is achieved by creating a Windows service named LogMeIn Hamachi (Wave 1) or HamachiNet (Wave 3). Code injection in Wave 1 targets SearchIndexer.exe, taskeng.exe, iexplore.exe, and taskhost.exe; Wave 3 swaps in wininit.exe and dwm.exe alongside SearchIndexer.exe and taskhost.exe. The Wave 1 C2 was virusblocker[.]it[.]com:443 (HTTPS) protected by an RSA-2048 public key; Wave 3 rotates to sentinelonepro[.]com:443 with a refreshed RSA key. Wave 1 mutex HJBNDusadnfy3278rnhsdaf is replaced by HJKMNbxzcv9876asdfghj in Wave 3, and components are relocated to C:\Recovery\.

Terndoor (Wave 2, late January 2026). Approximately a month after the initial intrusion, attackers returned through the same Exchange entry point and deployed a renamed deskband_injector64.exe as C:\ProgramData\USOShared\USOShared.exe (MD5 762f787534a891eca8aa9b41330b4108), abusing it to sideload a malicious winmm.dll. The DLL contained a Mofu shellcode loader whose prologue is a NOP + CALL pair that uses the return address to locate an encrypted payload appended to the shellcode. A 12-byte header (4-byte seed + two 4-byte size fields) precedes the encrypted body, which is decoded with a one-round subtract-XOR-add transformation, decompressed with LZNT1, and reconstituted into a Terndoor PE with stripped MZ/PE headers. Recovered configuration strings include msdt.exe (injection target), cache.dat (payload container), vmflt.sys (kernel driver dropped to C:\ProgramData\USOShared\), and xboxs.sys (function unknown). Registry artifacts HKLM\SYSTEM\ControlSet001\Services\vmflt\Type=1 and ImagePath=\??\C:\ProgramData\USOShared\vmflt.sys evidence the rootkit-class kernel driver service. The defensive product blocked execution before full installation; the first 4 KB of the loader was recovered from memory. The RC4 key-scheduling fingerprint matches the Terndoor sample documented by Cisco Talos in the UAT-9244 reporting. During this wave the host contacted ipinfo[.]io to enumerate its public IP.

Lateral Movement. In Wave 1 the attackers leveraged stolen domain administrator credentials to perform interactive RDP into a second host, where they spawned a PowerShell console and manually staged the malware files. A third system was infected via Impacket-style atexec/smbexec utilities executed from a Linux origin, indicating an established attacker workstation outside the Windows fleet.

Operational Pattern and Strategic Significance. The attackers' willingness to return three times to the same Exchange server, swap backdoor families (Deed RAT → Terndoor → Deed RAT), and refresh tradecraft mid-operation evidences sustained espionage intent and operational discipline. FamousSparrow has historically targeted telecoms, government, and technology sectors across the United States, Asia-Pacific, the Middle East, and South Africa; this campaign is the first publicly reported expansion into South Caucasus energy. The targeting aligns with Azerbaijan's growing role in European energy security following the December 2024 expiration of Russia's Ukraine gas transit agreement, the early-2026 Qatar LNG suspensions and Strait of Hormuz disruptions, and Azerbaijan's reported 56% cumulative growth in gas exports to 13 European countries since 2021.

Defender Implications. Detection must hunt for: (a) ProxyNotShell webshell patterns in MSExchangePowerShellAppPool child processes; (b) LMIGuardianSvc.exe or deskband_injector64.exe running from C:\TEMP, C:\ProgramData\USOShared, or C:\Recovery rather than their canonical install paths; (c) services named LogMeIn Hamachi or HamachiNet on hosts that have never had LogMeIn installed; (d) StartServiceCtrlDispatcherW hooking patterns inside non-system processes; (e) creation of HKLM\SYSTEM\ControlSet001\Services\vmflt with kernel driver Type=1; (f) outbound TLS to virusblocker[.]it[.]com or sentinelonepro[.]com; (g) Impacket atexec/smbexec service-creation footprints (random 8-character service names invoking cmd.exe with redirected output).

## MITRE ATT&CK

- T1595 Active Scanning
- T1583.001 Acquire Infrastructure: Domains
- T1588.002 Obtain Capabilities: Tool
- T1587.001 Develop Capabilities: Malware
- T1190 Exploit Public-Facing Application
- T1078.002 Valid Accounts: Domain Accounts
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1569.002 System Services: Service Execution
- T1047 Windows Management Instrumentation
- T1505.003 Server Software Component: Web Shell
- T1543.003 Create or Modify System Process: Windows Service
- T1574.001 DLL
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1027.013 Obfuscated Files or Information: Encrypted/Encoded File
- T1620 Reflective Code Loading
- T1055.001 Process Injection: Dynamic-link Library Injection
- T1070.004 Indicator Removal: File Deletion
- T1036.005 Match Legitimate Resource Name or Location
- T1112 Modify Registry
- T1003 OS Credential Dumping
- T1057 Process Discovery
- T1016 System Network Configuration Discovery
- T1082 System Information Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1573.002 Encrypted Channel: Asymmetric Cryptography
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1014 Rootkit

## Sources

- [FamousSparrow APT Targets Azerbaijani Oil and Gas Industry — Victor Vrabie, Bitdefender Business Insights (US)](https://www.bitdefender.com/en-us/blog/businessinsights/famoussparrow-apt-targets-azerbaijani-oil-gas-industry)
- [FamousSparrow APT Targets Azerbaijani Oil and Gas Industry — Bitdefender Business Insights (UK)](https://www.bitdefender.com/en-gb/blog/businessinsights/famoussparrow-apt-targets-azerbaijani-oil-gas-industry)
- [FamousSparrow: A suspicious hotel guest — ESET WeLiveSecurity (original FamousSparrow attribution)](https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/)
- [MITRE ATT&CK Group G0134 — FamousSparrow](https://attack.mitre.org/groups/G0134/)
- [NVD — CVE-2022-41040 (Microsoft Exchange Server-Side Request Forgery)](https://nvd.nist.gov/vuln/detail/CVE-2022-41040)
- [NVD — CVE-2022-41082 (Microsoft Exchange Remote Code Execution)](https://nvd.nist.gov/vuln/detail/CVE-2022-41082)
- [Microsoft Security Update Guide — November 2022 Exchange Server SU (ProxyNotShell)](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41040)
- [MITRE ATT&CK Technique T1574.002 — DLL Side-Loading](https://attack.mitre.org/techniques/T1574/002/)
- [MITRE ATT&CK Technique T1505.003 — Web Shell](https://attack.mitre.org/techniques/T1505/003/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0509